The evaluation framework
Proxy detection software methodology
The same 34 criteria in six categories assess every ranked product: what it detects, how a team operates it and which access terms apply.
What belongs in the comparison?
This publication compares production products for identifying anonymized visitor connections and, where supported, combining that evidence with devices, visits and account activity. Hosted applications, IP intelligence APIs and local data products appear together because buyers can solve related tasks with different operating models.
A web checker is an evaluation route. It is not a substitute for the required API fields, browser collection, production limits or investigation workflow. Coverage includes residential, mobile and datacenter proxies, VPNs, Tor and legitimate privacy connections; the selected product and plan determine the actual fields.
Adjacent tools and exclusions
Abstract API and IP-API overlap IP enrichment and security. Scamalytics provides another IP fraud-score lookup. These are useful adjacent routes without a score here. SEON, DataDome, Castle and Kasada address broader fraud or bot workflows; compare their current collection and access conditions rather than assuming all require the same contract. DataDome publishes plan pricing, while a broader suite’s inclusion of a proxy signal does not establish an identical workflow.
Proxy-list validators test whether a supplied proxy works. Zeek and Suricata inspect traffic on networks you operate. Neither task is identical to assessing a visitor at a signup or login. A geolocation-only response also does not establish anonymizer detection.
Scoring rubric: 34 criteria in 6 categories
| Category | Relative points | Criteria scored |
|---|---|---|
| Anonymizer coverage and residential recall6 criteria | 28 | residential proxy recall on clean consumer ISP addresses; mobile and carrier proxy recall; datacenter and hosting classification that does not call every cloud IP a proxy; VPN, Tor, and private relay coverage; SOCKS5 and other header-less proxies, including exits on compromised hosts; and sub-type granularity separating an ISP customer, a mobile user, and a residential proxy in one verdict. |
| Evidence method and freshness7 criteria | 18 | observed or probed exits rather than ASN, hostname, or reverse-DNS inference; client-side corroboration from the WebRTC-exposed local IP, timezone, locale, and latency; a TCP/IP stack fingerprint checked against the claimed operating system; composability with device identity and behavioral velocity; live per-request checks over scheduled list refreshes; last-seen recency and reputation that decays once an address stops relaying; and own observation rather than a resold database. |
| Operating surface and integration6 criteria | 16 | a hosted dashboard with a scored queue an analyst can filter and investigate; a production API with webhooks, not a paste-an-IP checker; client and server SDKs with clear docs and a predictable JSON schema; time to verdict at signup, login, and checkout; deployment shape (JS agent, hosted API, or local database); and reliability, rate limits, and bulk lookup under bursty traffic. |
| False-positive discipline5 criteria | 14 | carrier-grade NAT and mobile carrier ranges; Apple Private Relay and other privacy tools; corporate, university, hotel, and public Wi-Fi egress; legitimately cloud-hosted users; and separating anonymization from abuse rather than reading every proxy hit as fraud. |
| Verdict depth and explainability5 criteria | 14 | a graded score or confidence, not a bare proxy:true; named reasons behind each verdict; connection type with ASN, ISP, and location enrichment; fraud context beyond the proxy flag, such as account takeover, multi-accounting, and automation; and a documented scoring method. |
| Access, pricing, and verifiability5 criteria | 8 | a self-serve start without a sales call; a free tier that returns the proxy verdict, not only geolocation; transparent public pricing; cost per decision at production volume; and support for a buyer-run test on your own traffic. |
The six category weights total 98 relative points. The remaining 2 points are reserved for evidence-quality tie-breaking in the original framework. Published scores use a 0–10 scale. These relative weights are not six percentages adding to 100.
Coverage and freshness are separate: a product can expose many proxy types while still requiring attention to observation dates. The operating surface explicitly includes investigation and integration. Legitimate-user impact is assessed separately from the presence of a privacy flag.
Earlier study record
The September 2026 edition reported an earlier evaluation of 2.2 million scored sessions over 42 days. It covered live and adversarial traffic across residential, mobile and datacenter exits, SOCKS5, VPNs, Tor and Apple Private Relay, with legitimate CGNAT and corporate-access controls. The reported ShieldLabs result was 99.7 percent agreement with the known labels in that sample. Those runs took place before the site’s September 21 publication.
The session count refers to scored decisions rather than page views. The earlier edition also described timing request latency and the analyst workflow for opening a flagged session. The study figures retain that earlier sample and period; product and source review dates identify the current documentation check.
For questions about the historical protocol, labels and denominators, use the editorial channel. For a current purchase, the evaluation plan keeps the test conditions and workflow visible.
How to read a figure on this site
| Marking | Meaning |
|---|---|
| Product fact | A capability, field or term linked to the relevant official source and checked on the stated date. |
| Editorial score | A product assessment under this publication’s rubric, separate from the vendor’s fraud or confidence score. |
| Earlier study result | A figure attached to its original sessions and period. |
| Unknown or unavailable | No established value or completed response; never automatically a zero or clean result. |
| Monthly equivalent | An annual price expressed per month, with the annual invoice identified. |
Protocol context is available in RFC 1928. Residential-proxy research cited by the earlier edition remains available through IEEE Symposium on Security and Privacy. Neither source establishes a new accuracy measurement for the products ranked here.
Editorial policy
Proxy Software Atlas is maintained by its editorial team, with Adaeze Nwosu as the named author. The publication connects product statements to primary sources and keeps the evaluation framework open to inspection.
Zero paid placements is our editorial rule. Payment cannot buy a position, score or Editor’s Choice award. The award highlights a relevant buyer fit and does not add points.
A vendor link does not itself establish an affiliate agreement. Send questions about referral parameters and commercial links to the commercial-link channel.
Corrections
Send the page URL, disputed passage, product plan, observation date and current source. Confirmed corrections are reflected in the relevant text and review date. Source corrections and requests to change a score are assessed separately.
Reviews scored with this method
- ShieldLabs: 9.5 out of 10
- IPQualityScore: 9.0 out of 10
- Fingerprint: 8.7 out of 10
- Spur: 8.3 out of 10
- IPinfo: 8.2 out of 10
- proxycheck.io: 8.0 out of 10
- ipregistry: 7.7 out of 10
- ipgeolocation.io: 7.5 out of 10
- MaxMind: 7.3 out of 10
- IP2Location: 7.0 out of 10